Malicious PDF — malware analysis report

Static analysis result for SHA-256 b961e855452e18d2…

MALICIOUS

PDF

31.4 KB Authoring application: Pdftk
MD5: 084f7824460116946c28cb7707fbc569 SHA-1: c208addf90e866d5bb22e56740cd2088af73a632 SHA-256: b961e855452e18d228666fc6c0870b720a60dcd60e2f26969613ea32a31535f2
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly suggest malicious intent. The embedded URLs are likely used to distribute further malicious content or for SEO spamming purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://statsclothing.com/uploads/1/3/0/5/130590139/befepulomidudok-rufiju-zexuz-tivokufif.pdf
    • http://myers-adams.com/uploads/1/3/0/5/130544823/surigajo-nazejoted-tijasej-wifagujo.pdf
    • http://my-zero-stress.com/uploads/1/3/0/6/130604752/rojuxomeko.pdf
    • http://www.talesfromthefrontrow.com/uploads/1/3/0/6/130621344/4fa52ee.pdf
    • http://oasisbaypv.com/uploads/1/3/0/6/130604767/2789491.pdf
    • http://austinaction.com/uploads/1/3/0/6/130621695/2546125.pdf
    • http://immersivegis.com/uploads/1/3/0/3/130313088/9225440.pdf
    • http://mido4design.com/uploads/1/3/0/5/130551794/3594643.pdf
    • http://naturalproducts.shop/uploads/1/3/0/7/130775501/4071157f7fa.pdf
    • http://painmap.net/uploads/1/3/0/2/130289695/834265.pdf
    • http://gaylordspa.com/uploads/1/3/0/5/130543837/c443b3b84b0f43.pdf
    • http://www.lindastonecarving.co.uk/uploads/1/3/0/2/130272071/kuzegifu.pdf
    • http://incrediblegenius.net/uploads/1/3/0/7/130740217/xipepujoxivavo.pdf
    • http://www.mollyneves.com/uploads/1/3/0/5/130541424/8274617.pdf
    • http://111-ed.com/uploads/1/3/0/8/130874426/rekavanoleviduzusaru.pdf
    • http://lucysblockblog.com/uploads/1/3/0/6/130640162/9636027.pdf
    • http://shudit.club/uploads/1/3/0/7/130776490/2429515.pdf
    • http://thevictressvegan.com/uploads/1/3/0/7/130739423/jevuzajeb.pdf
    • http://bellafurworks.com/uploads/1/3/0/5/130543991/94060c.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003605.bin
7e4262ca29ae0a7d8ea64430b1b49c5d96b9c19a84ae412f29c868a8e22ea961		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3605 8060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.